Two Doors, No Third (Legal Processing Grounds)
Consent under Section 6 vs Section 7 Closed-List Legitimate Uses
India's DPDP Act recognizes only TWO legal doors for processing digital personal data: Door 1 (Valid Consent under Section 6) and Door 2 (The Closed List of Certain Legitimate Uses under Section 7). Crucially, there is NO Door 3: DPDP deliberately omits GDPR's open-ended 'Legitimate Interest' balancing test or 'Contractual Necessity' ground. Any processing that cannot fit within Section 7's 9 statutory clauses MUST obtain granular, affirmative consent under Section 6.
Two Doors, No Third (Legal Processing Grounds)
Door 1: Valid Consent (s.6)
- ✓Free, Specific, Informed, Unconditional, Unambiguous
- ✓Affirmative Action (no pre-ticked boxes)
- ✓Accompanied or preceded by Section 5 Notice in 22 languages
- ✓Withdrawable at any time via s.6(4)
Door 2: Section 7 Closed List (Certain Legitimate Uses)
Door 3: Non-Existent Door
NO Legitimate Interests, NO Performance of Contract basis, NO Commercial Necessity ground.
💡 Core Architectural Insights & Takeaways
Key technical and regulatory takeaways established by this architecture diagram.
📜 Statutory Grounding & Legal Perimeter
Primary Act and subordinate Rule provisions establishing the enforceable legal mandate for this diagram.
🏗️ Target Architecture & Impacted Systems
Enterprise nodes and store topologies impacted by this architectural pattern.
Domestic production database and primary system of record for loan servicing
Internal employer database holding employee payroll and candidate records
Immutable consent event store and Policy Decision Point issuing authority tokens
⚙️ Associated Operational Controls
Control Master Matrix obligations enforcing the standards illustrated in this infographic.
🛠️ Implementation Guidance & Traps
Recommended technical sequencing and operational failure modes to avoid.
Recommended Implementation Sequence
- Audit all enterprise data processing activities and map them to either s.6 or s.7.
- Migrate any GDPR 'Legitimate Interest' processes to explicit, granular consent flows.
- Segment HR data pipelines under s.7(i) separately from customer consent ledgers.
Enterprise Traps & Failure Modes
- ⚠️ Using pre-ticked consent checkboxes or bundled contractual acceptance.
- ⚠️ Relying on s.7(a) voluntary provision for downstream analytics or advertising.
📁 Verifiable Evidence Artifacts Vault
Required evidentiary workpapers for regulatory inspections and SDF audits.